Microsoft: Tech support scammers moving to email campaigns
Microsoft researchers have discovered new tech support scam campaigns being delivered through mass phishing emails.
The researchers discovered the company’s anti-spam filters blocked these attacks that use social engineering techniques like brand spoofing, mimicking legitimate communications and disguising malicious links, according to researchers.
The links attached to these malicious emails lead to tech support scam websites that are worded to trick the user into calling hotlines and paying for unnecessary support services for contrived problems with a device, platform or software, researchers said.
Tech support scams have been widespread for a number of years, but the use of email is relatively new. Microsoft said that it doesn’t point to hackers easing other attack methods. Rather, the cybercriminals are casting a wider net.
[Register Now: Upcoming HIMSS Healthcare Security Forum]
About 3 million users are targeted by tech support scams each month. Traditionally, these scams are found in malicious ads, phone calls or malware that features a false tech error message.
The phishing emails appear to be legitimate notifications from online retailers or professional social networking sites with malicious links hidden in harmless appearing text. Researchers said the link redirects the user to pharmaceutical or dating websites.
The landing page for the tech support scams mimic legitimate sites. However, the sites display pop-up messages with customer service phone numbers and fake warnings. As part of the scam, the users who call the number are directed to agents who trick users into paying for fake technical support.
Hackers have ramped up their phishing campaigns on the healthcare industry this year. A Washington University School of Medicine employee responded to a phishing email in March, compromising 80,000 patient records.
In June, Torrance Medical Center reported two email accounts were hit with a phishing attack in April.
A recent ESET study found that while C-suite executives are receiving quality cybersecurity education, the hackers will move to other employees to gain access to a network.
Twitter: @JessieFDavis
Email the writer: jessica.davis@himssmedia.com
